Loading story…
A high-severity vulnerability, CVE-2026-54061, affects Dgraph Alpha versions earlier than 25.3.5 and allows unauthenticated attackers to reach external snapshot import RPCs exposed on the public gRPC port 9080. The flaw is an authentication bypass (CWE-306) in which a remote client can send Badger stream data to a target group store without authentication or authorization, enabling direct tampering with database contents over the network.
Because the receiving process calls Prepare() before processing the imported stream, successful exploitation can delete and replace existing database data, creating high integrity and availability risk. The issue carries a CVSS v3.1 score vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, and the CVE record indicates proof-of-concept and automatable exploitation with total technical impact. Dgraph addressed the issue in version 25.3.5, which organizations should treat as the fixed release for exposed Alpha deployments.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2026-54061 was updated with references and SSVC information indicating proof-of-concept exploitation, automatable exploitation, and total technical impact. The issue describes unauthenticated external snapshot import in Dgraph Alpha that can delete and replace group store data.
Dgraph published version 25.3.5, the release identified in the CVE record as the version that fixes the authentication bypass issue affecting earlier releases.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dgraph disclosed two high-severity vulnerabilities that allowed unauthenticated attackers to compromise deployments through exposed administrative interfaces and query injection. **`CVE-2026-40173`** affects Dgraph **25.3.1 and earlier** and leaks the full process command line through the unauthenticated **`/debug/pprof/cmdline`** endpoint, exposing admin tokens passed with the startup flag **`--security "token=..."`**. Attackers can reuse the stolen token in the **`X-Dgraph-AuthToken`** header to reach admin-only endpoints such as **`/admin/config/cache_mb`**, enabling unauthorized configuration changes and other privileged operational actions when the Alpha HTTP port is reachable. A second flaw, **`CVE-2026-41327`**, affects versions **prior to 25.3.3** and allows pre-authentication full read access to databases running with the default configuration and **ACL disabled**. The bug is caused by unsafe concatenation of a crafted **`cond`** field in an upsert mutation sent to **`/mutate?commitNow=true`**, which enables **DQL injection** and returns server-side query results directly in the HTTP response. Dgraph addressed the issues in **25.3.2** and **25.3.3**, respectively, underscoring the risk to internet-exposed instances that had not restricted debug access or hardened authentication settings.
Jun 29, 2026
A critical vulnerability in the open-source **Dgraph** graph database, tracked as `CVE-2026-34976`, allowed unauthenticated remote attackers to access the GraphQL administration API and invoke the `restoreTenant` mutation without authorization. The flaw, rated `CVSS 10.0`, affected Dgraph `25.3.0` and earlier because `restoreTenant` was omitted from the authorization middleware in `admin.go`, unlike the related `restore` operation that required Guardian-of-Galaxy authentication. By abusing `restoreTenant`, attackers could overwrite databases from attacker-controlled backups, read sensitive local files through `file://` paths, and trigger SSRF requests to internal services, including cloud metadata endpoints. The issue also exposed paths involving S3 or MinIO backup sources, encryption keys, and Vault credentials, creating a risk of complete compromise of confidentiality, integrity, and availability. Dgraph addressed the issue in version `25.3.1`, and defenders were urged to keep administration endpoints such as port `8080` off the public internet and restrict access to trusted internal IPs.
Jun 29, 2026
A critical improper authorization flaw tracked as **CVE-2026-72575** affects **Daptin** through **v0.12.34**, allowing unauthenticated remote attackers to read, create, update, and delete `usergroup` objects. The bug stems from permission-check logic in Daptin's authorization code that returns `true` when both the stored owner `UserId` and the requester's `UserId` are `null`, effectively treating guest sessions as authorized owners for records loaded without a user association. The vulnerable behavior impacts `usergroup` rows because they are loaded with a null owner and no `user_account_id`, enabling full CRUD access without credentials. The issue is classified as **CWE-284** and carries a **CVSS 9.1** score with vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`. Daptin's repository shows recent work to harden authentication, and defenders are advised to upgrade to a version later than **v0.12.34** and enforce authorization checks that reject null or zero-valued user references.
Aug 11, 2026